Real ITGC Interview Questions from Big 4 Firms : Must-Know Questions

for more information you can check my LinkedIn profile and if you new to the channel do subscribe to my channel and click on the bell icon to make sure you should not miss my future videos on a similar topic so without wasting a time let's start with the first part thank you okay so first question which is a very common question asked by the technical interviewer and all that can you walk me through your process for independently testing the ITGC control to determine their design and operating effectiveness because see normally in the ITGC jobs and all that whether it is map with SOX SSAE and all that so we have to do the testing of control so as an interviewer he was expecting or she was expecting you know the basics okay you know the process if they're hiring for experience profiles and all that they're looking for experienced candidate and all that so they mostly ask this question do you know the process how to test the controls and everything so so you know my session is basically you know if you have a zero experience then this is basically where you have to play you do some little bit acting okay or if you have not worked on this area you're not very confident but you have to bring that experience understood so how to answer so as i say you know how to answer such questions so you ask me like you know in one of my interviews I say okay in my experience like now I there is a process which is begin with understanding the control environment and its objective and I start by reviewing documentations to identify the controls in place and their intended purpose so here what happened I will basically talk about the process the first step is basically understand the control environment and objectives okay for example and here what i'm doing is i'm going to add some examples so that builds some credibility and it builds the confidence for example when i'm saying understanding a control environment objective how to answer such thing is like let's say example in my experience the process began with understanding the control environment and it's objective and I start by reading the documentations to identify the controls in place and their intended purpose for example if I'm testing the access control let's take example if I'm testing the access control because access control is also one of the ITGC information technology general control so if I'm testing the access control so I will look for the policies of access controls because policy basically talk about design of control okay I will look at the policy that describe how the user access should be managed and next I will conduct the interview with the key stakeholder to gain insight into the operational aspect of the control because sometime what happen is the control what we have is not necessary is implemented thoroughly i will give one more example is like every system must be protected with the eight character password so that is basically a policy so we have reviewed the policy documentations second is review the documentations and identify the controls so here we have taken the example you know that access rights are review every quarter or system should be protected with eight character password so i will check if there is a documented process for that so whatever I also select the sample period say like last six months and check if the access is completeness so this is how I'm going to answer so here you can see I am explaining the process also testing the access control I will look for the policies that describe how the user access should be managed and next I will conduct the interviews with the key stakeholders to get insight into the operational aspect of the control And for design effectiveness, I assess whether the control is appropriately designed to mitigate the identified risk.

For instance, the control might require that access rights are reviewed every quarter, so I will check if there is a documented process for this.

And for operating effectiveness, I will perform the testing by selecting representative samples and evaluating the control operation over a specific period.

I also select the sample period so like let's say last six months or one year and I check if the access rights were conducted timely so here what happened there was a policy for access control and I will basically collect the logs from the systems to verify is this followed properly or not and I document all the findings and have a discussion with the control owner to ensure I understood everything correctly and in the report I will look make sure I will look for the accuracy and completeness so when I am presenting the risk so I will document the risk I will document the threat I will document the vulnerability and I will also document the recommendations action plan will prepare by the business owner so this is how you know I will basically handle such kind of a queries so let's move to the question number two okay second question is describe a specific instance okay where your testing identify significant control gaps and how did you handle it and what was the outcome now this kind of a question test your leadership skills test your common sense test your patience and it basically give the visibility to the interviewer how to fix your role how to use your profile in the projects and a lot of users a lot of students basically got this question so I thought let me add this so it's a very common one okay so question is how to answer as I said you need to speak in such a way that it reflect your experience so your response should be like you know at a previous organization during the ITGC I discovered you know there is a user access review was not been performed consistently which is leading to the potential unauthorized accesses it mean that okay we have a process called we issue the identity then we basically manage the identity and then we revoke the identity so we've as per the user access we issuing the identity we monitoring the identity but problem is that we're not revoking because revocation is a manual process so me as a consultant me as an auditor I was doing in this assessment and during that I did identify inconsistent user access review what I discovered here is can see that a lot of people who left the company still they have access system okay it mean the employee who left the company or changed their role they still has access to the system this concept is called as a scope creep scope creep access aggregation or scope creep where you get more and more access and your previous access is not revoked so what i did here is i immediately issue to the management because that time the company very small in your case you have to report to the respective lead of the idm see i'm doing an assessment okay so i will prepare the complete report but this is something very critical so i will immediately notify and i will document that in a report so here what i did is i immediately escalate this to management and highlighting the risk Okay and I highlight the risk associated with this deficiency.